Risk Management and Internal Controls
What the exam tests
This domain tests whether you can identify, measure, monitor and control credit, liquidity, operational and reputational risk through limits, segregation, audit and escalation.
Core rules
- The board approves the risk framework, risk appetite and limits. Management translates these into branch-level limits for cash, exposure, delegation and exception approval.
- Segregate initiation, authorisation and reconciliation. Maker-checker, dual custody, access controls and staff rotation reduce fraud and error.
- Maintain a risk register and key risk indicators such as cash differences, overdue accounts, audit exceptions and reconciliation ageing. Escalate breaches promptly.
- Internal inspection, concurrent audit and statutory audit must lead to tracked corrective action, not just reports. Follow up on every high-risk observation.
- Maintain a business continuity plan for power, cyber, telecom and staffing failures, and test it periodically.
Worked example
An officer opens a ₹5 lakh fixed deposit in a customer's name without receiving funds, to meet a target, then cancels it. Detection comes from reconciling the FD register with the general ledger and customer statements. The control failures are issuance without cash or transfer verification and absence of independent maker-checker review. Corrective action includes reversing entries, reporting the fraud and reviewing access rights and staff accountability.
Traps that cost marks
Hiding exceptions, allowing one person to control cash and books, not rotating staff, treating audit follow-up as paperwork and failing to test the BCP are common weaknesses.